- Move validate.sh ownership to skill-audit/scripts/ — it is the canonical
structural validator; skill-write now delegates Step 5 to /skill-audit
- Add skill-write/references/scripts.md and deployment-modes.md for progressive
disclosure of package runner patterns and plugin cache isolation rules
- Fix skill-audit Step 1 cross-skill path reference (was repo-absolute, now
skill-relative); add manual fallback for sandboxed/Bash-denied contexts
- Scope Step 2 "read every file" to exclude binaries and unreferenced files
- Fix new-skill.sh next-steps output to reference /skill-audit instead of
the removed validate.sh
- Remove stale Dependencies section from skill-audit README; flip dependency
arrow — skill-write depends on skill-audit, not vice versa
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Moves the previous write-skill implementation to docs/examples/skill-write/write-skill/
for reference. The skill has been superseded by the spec-compliant skill-write rewrite.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rewrote the skill authoring factory skill from scratch against the agentskills.io
specification. Renamed write-skill → skill-write (name now matches directory per spec).
skill-write:
- Full scaffold via new-skill.sh (annotated templates for SKILL.md, README.md,
scripts/, references/, assets/)
- validate.sh checks all spec constraints deterministically (name format/length,
description length, placeholder detection, line count, script rules)
- SKILL.md body includes description rules, body discipline, patterns, and scripts
guidance with "why" rationale throughout
- Templates usable standalone by agents and humans
skill-audit:
- Structural validation (via validate.sh) + seven qualitative dimensions
- Produces PASS/FAIL/SUGGESTION punch list with per-FAIL fix proposals
- Report-only: does not apply fixes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds write-agent to plugins/kyberforge/skills/ — a factory skill parallel
to write-skill that authors Claude Code subagent definitions and cross-tool
plugin agents (Claude Code + GitHub Copilot CLI two-file pattern).
Includes research references (claude-code-agents.md, copilot-cli-agents.md,
cross-compat.md), three asset templates (subagent, plugin-agent-claude,
plugin-agent-copilot), eval coverage, and CATEGORIES.md updated to register
write-agent in the factory category per the conflict check finding.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Removes the project-scoped context MCP server entry with pinned library filters.
Context7 is now integrated directly into the research skill; the neuledge-context
project scope is no longer needed here.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds Context7 resolution before websearch for library/framework/API topics,
reducing reliance on web crawling for well-indexed libraries. Falls back to
websearch for unresolved libraries, concept topics, or when the user provides
starting URLs. Subagents are explicitly prohibited from calling Context7 to
prevent tool inheritance from producing duplicate or conflicting summaries.
Includes trigger and output evals for the Context7 path (resolves, fallback,
skipped for non-library topics), stale description and constraint fixes, and a
concrete "sufficient content" threshold.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Standalone /research skill that scans the codebase, discovers canonical
sources via websearch, reads and deepens in parallel via subagents, and
writes structured topic files + sources.md to an explicit output path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- claude plugin validate --strict absent from standard test sweep
- gitleaks source/deployed config silent divergence risk
- shellcheck without -x blocks pre-commit on scripts using source
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
gitleaks false positive (U1, Gitea issue #2):
- 'Token routing: Haiku/Sonnet/Opus' in ai-coding-factory-session.md:90
triggers generic-api-key on entropy match of "Token". Not a credential.
- ROADMAP.md now documents this pattern and triggers the same rule.
- Both .gitleaks.toml (deployed, read by hook) and scripts/gitleaks.toml
(source for setup-gitleaks.sh deploys) updated and aligned. Previously
out of sync — deployed file had docs/research/.* already; source did not.
ROADMAP.md: governance workstream Phase 2 expanded with 7 immediately-
actionable test suite gaps and 5 Chunk 6 CI gaps, all mapped to
CONTROLS.md requirements. Housekeeping updated with audit entry.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
Per repo convention, .gitkeep files are removed when the directory is
first populated with real content. Both directories are awaiting their
first ARD and Bug Brief respectively (Chunk 3+ work).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
claude plugin validate scans all .md files in agents/ as agent
definitions and warns on missing YAML frontmatter. The file was a
contributor guide, not an agent. Kyberforge ships no agents, so the
agents/ directory is now correctly empty.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
Two related fixes exposed when install.sh was first staged post-audit:
1. shellcheck invocation in setup-hooks.sh lacked -x, causing SC1091
(info) to fire for any .sh file that sources another, blocking the
pre-commit hook on legitimate scripts.
2. The shellcheck source= directive in install.sh pointed to
'deploy-manifest.sh' (bare filename). With -x, shellcheck resolves
this from CWD (repo root), where the file doesn't exist. Updated to
'scripts/deploy-manifest.sh' — the correct repo-root-relative path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
- neuledge-context v1.2: document that --libs identifiers must include
version suffix verbatim from `context list` (e.g. name@latest);
add rebuild workflow for packages with bad crawl/low section count;
add failure cases for get_docs returning Package not found and
/reload-plugins not restarting stdio MCP processes
- .mcp.json: fix all --libs identifiers to include @latest suffix;
update claude-code-docs to @2.1.98 (rebuilt from GitHub, 636 sections
vs 9 from the previous bad web crawl)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
- Fix claude mcp add scope flag: -s user for global, -s project for
per-project --libs (--project flag does not exist)
- Project scope writes to .mcp.json (committed); not settings.local.json
- Document dual-scope pattern and expected conflict warning
- Document MCP tools not available mid-session after claude mcp add;
require /reload-plugins or new session
- Expand context add step with llms.txt-first workflow for registry gaps
(Anthropic, Claude Code, MCP docs not in public registry)
- Fix self-check: explicit scope flag required, context list for identifiers
- Add .mcp.json with project-scoped context serve --libs for this repo
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
Adds a complete cross-cutting skill to install, configure, and manage
@neuledge/context — a local-first MCP server that delivers version-specific
library docs to AI agents via SQLite FTS5.
Includes:
- SKILL.md with 9-step process: install, global MCP registration, per-project
--libs scoping, package management, auth, custom registry, upgrade, uninstall
- setup-neuledge-context.sh: pinned version install, idempotent version check
- secure-context-config.sh: chmod 600 on ~/.context/config.json after auth
- 13-case test suite covering both scripts (all pass)
- eval.yaml with 6 trigger tests and 4 output tests
- references/: context-cli-reference.md, http-mode.md, install-notes.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
trap '...' RETURN inside a function is NOT local to that function in bash
— it persists in the calling scope and fires on every subsequent function
return. After install_shellcheck set the trap, it fired again when
ensure_tool returned with $tmp_dir unbound, causing nounset abort.
Fix: change install functions from {} to () (subshell bodies) and use
trap EXIT instead of RETURN. The trap is now scoped to the subshell and
cannot leak to callers.
Also fixes double _os() call in install_jq and removes redundant local
declarations (subshells don't need them).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
setup-hooks.sh now installs shellcheck, jq, and yq if absent rather
than warning and continuing. Follows the same install pattern as
setup-gitleaks.sh (curl + install to TOOL_INSTALL_DIR=/usr/local/bin,
OS/arch detection, pinned versions).
Pinned versions: shellcheck 0.10.0, jq 1.7.1, yq 4.44.3.
The deployed pre-commit hook retains its runtime fallbacks as a safety
net for environments where tools are removed after setup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
Two bugs in setup-hooks.sh:
1. awk+mv to replace a marker block created a 644 temp file, losing the
exec bit. chmod +x after every write_block call fixes this. Regression
test added to idempotency block.
2. set -euo pipefail in the deployed pre-commit hook caused grep to exit 1
when no files of a given type were staged, aborting the hook. Changed
all filter pipes to process substitution with || true so no-match is
handled gracefully.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
Adds setup-hooks.sh and check-manifests.sh as the deterministic
enforcement layer described in docs/research/governance_principles/CONTROLS.md.
- commit-msg: conventional commits pattern check (hard block)
- pre-commit: shellcheck on .sh, jq on .json, yq on .yaml/.yml,
SKILL.md frontmatter validation; optional tools degrade gracefully
- pre-push: full test suite + manifest cross-reference check
- check-manifests.sh: validates marketplace.json plugin sources,
plugin.json skill/hooks/mcpServers path references
- Marker-based blocks (idempotent, composable with gitleaks)
- 33 integration tests across two test scripts
Run scripts/setup-hooks.sh to install into any repo's .git/hooks/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
No longer needed — kyberforge plugin-create provides a bundled template that
serves as the canonical scaffold reference. Remove hello-world from marketplace
manifests and update docs accordingly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Move all evals into each skill's own evals/ directory and test_scripts.sh into
marketplace-architect/scripts/ so test artefacts live alongside the code they test.
Also fix: hooks.json array→object, displayName title-case, marketplace.json owner
placeholders, and .github/plugin/marketplace.json metadata-wrapper schema divergence.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds plugins/, .agents/evals/, and .claude-plugin/ to the structure
section. Clarifies that .agents/skills/ contains directly-deployed skills
only; marketplace and factory skills now live in plugins/kyberforge/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Renames plugins/kyberforge/skills/create-plugin/ to plugin-create/ to match
the directory-based skill name Claude Code uses for slash commands. Adds
.claude/settings.json with kyberforge plugin enabled. Gitignores
.claude/settings.local.json (machine-local MCP permissions).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Updates Skills glossary to document both direct and plugin-based deployment
paths. Updates META.md path to reflect write-skill move to kyberforge plugin.
Adds Plugin and Plugin marketplace glossary terms.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds plugin marketplace workstream section documenting Phase 1 completion.
Updates skills pipeline note and pre-0019 cleanup paths to reflect skills
and evals now living in plugins/kyberforge/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Updates overview.md and architecture.md to document the kyberforge plugin,
the moved skills and evals, the removal of templates/, and the new plugins/
directory in the repo structure.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Moves create-plugin, marketplace-architect, write-skill, and write-eval
from canonical .agents/skills/ into plugins/kyberforge/skills/, along
with all bundled sub-files, evals, and the plugin-marketplace-architecture
research doc. Bundles templates/plugin/ into create-plugin/assets/plugin-template/
so the skill is self-contained after install-time caching. Removes
templates/plugin/ and docs/research/plugin-marketplace-architecture.md
from the repo root as they are now exclusively in the plugin.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Scaffolds the kyberforge marketplace management plugin (create-plugin and
marketplace-architect skills will live here). Renames the plugin-create
skill directory to create-plugin to match the canonical kebab-order convention.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the plugin-create skill (.agents/skills/plugin-create/) that scaffolds
a new plugin from templates/plugin/, substitutes PLUGIN_NAME/AUTHOR_* markers,
registers the plugin in marketplace.json, runs claude plugin validate ., and
hands off to /marketplace-architect. Includes evals and the generic template
with all components (agents, skills, hooks, MCP, bin, docs) with per-directory
READMEs explaining what goes where and which tool reads each directory.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
23 tests covering the full JSON-RPC 2.0 protocol surface:
initialize handshake, silent notifications/initialized, tools/list
schema, tools/call with and without args, unknown tool error,
unknown method error, and invalid JSON resilience.
Fixed assert helpers to use grep -qF -- to prevent leading-dash
patterns (like -32601) from being parsed as grep flags.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Minimal dependency-free Node.js MCP server (JSON-RPC 2.0 over stdio).
Exposes one tool: say_hello. Handles initialize, tools/list, tools/call,
and SIGTERM cleanly. No npm packages required — uses only readline.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Applies the same shared-field sync logic to the two marketplace.json
files that we already applied to plugin.json: name, owner.name,
description, version, and the full plugin catalog (name, source,
description per entry) must match across .claude-plugin/ and
.github/plugin/ manifests.
Fixes .github/plugin/marketplace.json to use the canonical Copilot
schema (description and version nested under metadata) rather than
a copy of Claude's top-level format. Adds owner field to both files.
Validate.sh handles the structural divergence by extracting values
from either location before comparing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds every cross-compatible component between Claude Code and Copilot CLI:
skills (shared), agents (per-tool .md vs .agent.md), hooks (per-tool
paths), and .mcp.json (shared). Both plugin.json manifests now carry all
shared identity fields (name, description, author, license, keywords)
with Copilot-specific component paths only in the root manifest.
Updates validate.sh sync check to verify shared identity fields rather
than demanding content equality, since component path declarations
legitimately diverge between tools.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds marketplace scaffolding (.claude-plugin/marketplace.json,
.github/plugin/marketplace.json) and a hello-world proof-of-concept
plugin to validate the format before migrating real skills.
Also fixes inventory.sh to include .agents/ in the hidden-dir exception
list so audits correctly surface the 16 existing skills.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a new skill for creating, managing, and adopting plugins across
Claude Code and GitHub Copilot CLI marketplaces. Includes three Bash
scripts (inventory, gen_manifests, validate), three reference docs
(cross-compat, claude-code, copilot-cli), a test harness with 18
passing tests, and an eval.yaml. Also adds the `marketplace` category
to CATEGORIES.md and commits the plugin marketplace architecture
research doc that informed the skill design.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Behavioral tests for write-eval, write-skill, and write-docs run via
fresh-context subagents (HOTL). All process steps verified correct.
Caveman defects surfaced during testing logged in 0028 for upgrade-skill.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Insert explicit self-check step (step 9) before HITL (step 10);
self-check runs after write-eval so all items are verifiable
- Remove HITL from self-check checklist — HITL may occur across a
PR boundary after the session ends
- Fix frontmatter constraint and self-check item to acknowledge
optional `model:` field alongside `allowed-tools`
- Conflict-check sub-agent now also reads factory-integration-decisions.md
with explicit precedence rule: integration decisions override factory
principles — prevents false positives from deliberately overridden decisions
- Bump to v1.5
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- AGENTS.md: add factory principles and factory-integration-decisions to
on-demand content index so they are discoverable for skill design work
- write-skill: insert conflict-check step (step 3) — sub-agent reads
constitution and factory principles after grill, before any writing;
hard gate with explicit self-check item; renumber steps 3–8 → 4–9
- META.md: bump to v1.4
Closes the gap identified in PRD chunk-3-skills-library §sub-agent-usage:
conflict checking against constitution and factory principles was specified
but never wired into the write-skill process.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add sub-file constraint: content-type split rule (explains vs. directs),
three spec-defined optional directories (scripts/, references/, assets/),
one-level-deep rule, and wiring syntax requirement
- Update output format section to list optional sub-files as a third output
- Add self-check item for sub-file placement and wiring
- Update SKILL-TEMPLATE.md constraints and output format examples to match
- Bump META.md to v1.3
- Add two LESSONS.md entries: research agents presenting synthesis as spec
fact; META-TEMPLATE fix deferred with explicit do-not-apply note
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add model: sonnet to SKILL.md frontmatter (Claude Code extension; correct
location per research — runtime config belongs in frontmatter, not META.md)
- Document model field in SKILL-TEMPLATE.md with factory §9 routing guidance
- Wire grill output explicitly to trigger description step (step 3 now references
agreed name/category/purpose from grill rather than drafting independently)
- Strengthen eval self-check: presence check → coverage check (trigger cases +
at least one output case required)
- Bump META.md to v1.2 (2026-05-26)
- Add three LESSONS.md entries: META-TEMPLATE comment retention, overlap check
scope (deployed dir not just repo), model field placement boundary
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
